The Backup and Staging by WP Time Capsule plug‑in for WordPress stores an admin‑decrypted SQL backup in its upload directory after a decryption operation. An authenticated user with subscriber‑level access or higher can call the download_recent_decrypted_file_wptc function to retrieve this file, which usually contains password hashes, user credentials, and other sensitive site configuration data. The flaw is an authorization bypass (CWE‑862) that allows the privileged user to download the backup even though normal file‑access controls should have restricted this action.

WordPress sites using the Backup and Staging by WP Time Capsule plug‑in from revmakx. Versions up to and including 1.22.26.

The CVSS score of 6.5 indicates moderate severity, while an EPSS score of < 1% suggests a low probability of exploitation at this time. The plug‑in is not listed in the CISA KEV catalog. Attackers must possess subscriber‑level or higher credentials and operate on a site where an administrator has previously performed a decrypt action, causing the decrypted backup file to exist in the plug‑in’s upload directory. Successful exploitation would expose sensitive database information to the attacker.